NetSight
IP …
medium5.5

CVE-2024-38618

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Set lower bound of start tick time Currently ALSA timer doesn't have the lower…

Impact

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Set lower bound of start tick time Currently ALSA timer doesn't have the lower limit of the start tick time, and it allows a very small size, e.g. 1 tick with 1ns resolution for hrtimer. Such a situation may lead to an unexpected RCU stall, where the callback repeatedly queuing the expire update, as reported by fuzzer. This patch introduces a sanity check of the timer start tick time, so that the system returns an error when a too small start size is set. As of this patch, the lower limit is hard-coded to 100us, which is small enough but can still work somehow.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
before 4.19.316
from 4.20 before 5.4.278
from 5.5 before 5.10.219
from 5.11 before 5.15.161
from 5.16 before 6.1.93
from 6.2 before 6.6.33

References